CVE-2026-38057
HighCVSS 8.1Summary
The iDirect iQ200 device does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie lacking the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss.
Risk Assessment
The risk is a CSRF attack that can reboot the device and disrupt satellite connectivity. Repeated attacks can cause a persistent denial-of-service (DoS) condition, impacting network operations.
Recommendation
Immediately update the iDirect iQ200 firmware to a version that includes CSRF protection. Until the update is applied, restrict management interface access to trusted networks and implement additional safeguards such as Origin header validation.
Other vulnerabilities in iDirect iQ200
Original NVD description (English source)
The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.